# P7-07 — Documents owner-scoped index

**Backend implemented scope: CONDITIONAL GO; final hygiene and normal push pending. Documents UI has not started.** Follow the exact [Phase 6 handoff](../../phase-6/p6-05/PHASE7_HANDOFF.md#migration-order-and-commit-boundaries) and [Documents architecture](../../phase-3/DOCUMENTS_UX.md). Implement and push the metadata projection before the interface.

The preceding compose commit `223dcf57d26bab624261994b61a46f2d3e2dd5b2` was normally pushed and directly verified at **2026-10-14 11:03:15.576853 UTC**: clean HEAD = origin = live development; local/origin/live main remains `27657f31131cd95d42f0e1290853ec9c9b3959a4`. [Entry evidence](evidence/entry.json) records the receipt and fresh existing-contract baseline: **37 passing cases**, unchanged Release DLL, with all20 captured sources unchanged before/after. This is an existing-contract subset, not a Documents endpoint or full-suite execution.

## Bounded contract

Authenticated `GET /api/documents` indexes existing CV variants, cover letters/history, application-answer/recruiter drafts, tailored CV drafts, attachments, frozen submitted packages and saved email drafts. It returns metadata, recorded source identifiers and existing destinations. It does not return bodies, notes, settings/profile JSON, rendered HTML, storage paths, bytes, recipient addresses, thread IDs or sending UUIDs.

Use validated pagination, literal metadata search, supported type/state/public-visibility/job filters and whitelisted name/date sorts. Count and page must execute in the database with bounded results. Every source, parent and company join must enforce the authenticated owner. Preserve independent/detached CVs and existing owned resources attached to soft-deleted jobs; expose the deleted-parent flag honestly.

Current CV/attachment, unsent draft material and frozen package are different states. CV public/private is independent of submission. A cover-letter history entry survives clearing current text and records whether current content exists. Submitted metadata uses captured CV identifiers/name/version and attachment counts; it cannot resolve these from mutable current sources. Uploading a certificate does not verify a qualification. A draft does not prove delivery; a captured package does not prove employer receipt.

Date sorting compares genuinely recorded UTC instants, including exact offset/fractional ordering. Legacy attachment `UploadDate` uses `DateTime.Now` without recording its timezone. Preserve its recorded local date for display and classify it `uploaded-local`; its UTC sort key is unavailable. Local/unknown dates remain after comparable dates in both ascending and descending order, with stable type/resource identity ties. Do not label this mixed index “last updated” or infer a timezone. Name sorting is unaffected. This policy requires explicit UI explanation and regression coverage.

## Validation and preservation

New ordinary HTTP regressions must fail against the missing endpoint before implementation, then pass with native SQLite. Cover every source, A/B/anonymous isolation, search/filter/count/pagination, literal wildcard characters, stable ties, offset/fractional dates, unknown-date placement, malformed relationships and source-history preservation. Inspect commands for count/order/limit/offset and absence of resource-body projection or writes. Listing must never render PDF, invoke AI, capture a package or access file storage.

Keep ordinary P2-D01 and exact frozen HTML/letter/archive-byte proof. The old Phase3 P2-D01 blocker is historical: the latest ordinary browser case passes in [P7-06](../p7-06/COMPOSE.md). Source actions retain existing ownership, CV association/detach rules, revision semantics and safe downloads. Native SQLite and MariaDB SQL composition are separate evidence; unexecuted MariaDB behavior cannot become production acceptance.

All57 preservation groups remain56 PARTIAL / C11 DEFERRED, with32 original routes preserved. Derived inventory is739/94 frontend,301 browser,1041 backend; it is not a fresh integrated pass count. Human reader, physical touch/software keyboard, zoom, provider/output and release conditions remain open. P5-13 is withheld; P7-06F is deferred; main unchanged, production NO-GO. No Phase8 implementation.

Next: finish the backend contract and its bounded evidence, commit/push/verify it, then migrate the Documents interface using the existing shared design system.

## Final backend observation

[Contract report](CONTRACT.md) and [portable results](evidence/contract-results.json) record final12/12 new contracts,80/80 related/auth/draft cases and actualProgram/nativeSQLite cookie3/3 plus ordinaryP2-D01PASS. Full .NET whitespace semantics, ordinal Unicode marker handling, actual bound pagination parameters, frozen metadata/bytes and strict tenant cases retain ordinary assertions. All failed attempts and source/timing qualifications remain. Final26/33/23 sources and binaries match; Release compilation and browser types pass. There is no DocumentsUI/axe/physical/human acceptance yet, and actualMariaDB execution remains unverified. Derivedbackend1053/browser304/frontend739/94 are not integrated passing counts. Hygiene and normal development push follow; the UI starts only after verified contract push.

Final metadata-contract hygiene PASS observed 2026-10-14T16:00:00.842457+00:00: secret and working/staged/phase whitespace gates pass;18 docs/504 local links resolve,57 groups and32 original routes retained. Backend contract implemented CONDITIONAL GO; normal development push pending. Actual MariaDB execution and Documents UI remain unverified; main unchanged, production NO-GO.